Global Cookie and Tracker Notice

Legal Rights & Agreement Rules · Context

Notice states an effective date of 09/09/2026

This version of the Global Cookie and Tracker Notice states an effective date of 09/09/2026. The text does not say whether it replaces an earlier notice or lists changes.

Supporting quotations

Effective Date: 09/09/2026

Not stated here

• Whether this version replaces an earlier notice, and what changed, is not stated in the supplied text.

Legal Rights & Agreement Rules · Context

"Mastercard" means the company and its affiliates

In this Notice, "Mastercard" covers Mastercard International Incorporated together with its affiliates, so the practices described are attributed to that whole group rather than a single company.

Supporting quotations

Mastercard International Incorporated and its affiliates (collectively, “Mastercard”)

Qualifications & exceptions

• Includes affiliates, not only Mastercard International Incorporated.

Not stated here

• The affiliates are not named or listed in the supplied text.

Legal Rights & Agreement Rules · Restriction or exception

On some partner Sites the partner stays the data controller

Where a client or partner provides a Site, and that Site's Consent Tool says Mastercard manages Cookies and Trackers for it (but Mastercard does not process any other Personal Information as controller), the client or partner is the data controller for all processing that does not involve Cookies and Trackers.

Supporting quotations

If a Site is provided to you by one of our clients or partners, and the Consent Tool on that Site indicates that Mastercard manages Cookies and Trackers for the Site (but does not process any other Personal Information as controller), that client or partner acts as the data controller for all processing activities that do not involve the use of Cookies and Trackers.

Qualifications & exceptions

• Applies only to Sites provided by a client or partner whose Consent Tool indicates that Mastercard manages Cookies and Trackers for the Site.
• Applies where Mastercard does not process any other Personal Information as controller.
• Covers processing activities that do not involve Cookies and Trackers; the supplied text does not say who is controller for the Cookie and Tracker processing itself.

Not stated here

• Who acts as controller for the Cookie and Tracker processing on those Sites is not stated in this block.

Cross-references

• exception to (model-proposed): Notice covers Mastercard's own Sites and its emails — The scope rule excludes client and partner Sites; this block describes Sites provided by a client or partner whose Consent Tool says Mastercard manages Cookies and Trackers, where the client or partner stays controller for other processing.

Legal Rights & Agreement Rules · Procedure

Broader privacy practices sit in other privacy notices

For broader privacy practices the Notice points to Mastercard's Global Privacy Notice. If a Site has its own privacy notice, the Notice says to refer to that notice instead.

Supporting quotations

To learn more about our broader privacy practices, please see our Global Privacy Notice. If a Site has its own privacy notice, please refer to that notice instead.

Qualifications & exceptions

• A Site's own privacy notice, where it has one, is the notice to use instead of the Global Privacy Notice.

Not stated here

• The Global Privacy Notice is linked but its text is not supplied, so its content is not described here.

Legal Rights & Agreement Rules · Context

Cookie data does not always count as "Personal Information"

"Personal Information" is defined as any information relating to an identified or identifiable individual. The Notice adds that information collected by Cookies does not always meet that definition, depending on applicable privacy laws.

Supporting quotations

“Personal Information” means any information relating to an identified or identifiable individual. Information collected by Cookies does not always meet the definition of Personal Information, depending on applicable privacy laws.

Qualifications & exceptions

• Whether Cookie data is Personal Information depends on applicable privacy laws.

Not stated here

• The Notice does not say which laws or which Cookie data fall on either side of the definition.

Legal Rights & Agreement Rules · Company commitment

Mastercard processes cookie data only where it has a legal basis

Mastercard says it processes Personal Information collected through Cookies and Email Trackers only where applicable law in the country where you are located permits it and only where it has a legal basis. The basis it relies on may differ by jurisdiction and by the type of Cookie or Email Tracker. Information collected by Cookies does not always count as Personal Information under this Notice.

Supporting quotations

We only process Personal Information collected using Cookies and Email Trackers where this is permitted under applicable laws in the country where you are located, and only where we have a legal basis for doing so. Because global privacy laws differ, the legal basis we rely on may vary by jurisdiction and by the type of Cookie or Email Tracker used.

Information collected by Cookies does not always meet the definition of Personal Information, depending on applicable privacy laws.

Qualifications & exceptions

• Depends on the country where you are located.
• The legal basis may vary by jurisdiction and by type of Cookie or Email Tracker.
• Concerns Personal Information; Cookie data is not always Personal Information, depending on applicable privacy laws.

Cross-references

• qualifies (model-proposed): Analytics and ad Cookies rest on consent, or legitimate interests where allowed — The general rule that Personal Information from Cookies and Email Trackers is processed only where law permits and a legal basis exists is applied by the table rows that follow.

Legal Rights & Agreement Rules · Company practice

Mastercard relies on consent where the country requires it

Mastercard says that in some countries consent is required before placing or accessing certain non-essential Cookies, or before using certain Email Trackers for functionality, performance or advertising. In those countries it relies on your consent. In other countries it may rely on additional or alternative legal bases, described in the table that follows. This sits alongside the general statement that it processes this information only where it has a legal basis.

Supporting quotations

In some countries, consent is required before placing or accessing certain non-essential Cookies or before using certain Email Trackers for functionality, performance, or advertising. In those countries, Mastercard relies on your consent. In other countries, we may rely on additional or alternative legal bases as described below.

Processing Activity Legal Basis for Processing (where required under applicable law)

only where we have a legal basis for doing so

Qualifications & exceptions

• Consent is relied on in countries where consent is required for non-essential Cookies or for Email Trackers used for functionality, performance or advertising.
• In other countries other legal bases may be used ("may").
• The table's second column is headed "where required under applicable law".

Not stated here

• The Notice does not list which countries require consent.

Cross-references

• qualifies (model-proposed): Mastercard generally asks consent before non-Essential Cookies — The later legal-basis section limits the general statement that Mastercard asks for consent: it relies on consent in countries that require it and may rely on other legal bases elsewhere.

Legal Rights & Agreement Rules · Company practice

Analytics and ad Cookies rest on consent, or legitimate interests where allowed

For using Performance, Functional and Advertising Cookies to understand how users interact with Sites, personalise content, or measure and improve campaigns, the table lists your consent to placing the Cookie and the related use of your Personal Information, where required by law (including EU ePrivacy rules). In countries that permit this without consent, Mastercard says it may rely on its legitimate interests in understanding and improving how users engage with its Sites, products or communications, provided those interests are not overridden by your privacy rights under applicable law. The row also covers Email Trackers used for functionality, performance or advertising where consent is required.

Supporting quotations

Using Performance, Functional, and Advertising Cookies to understand how users interact with our Sites, to personalize content, or to measure and improve campaigns. This includes any use of Email Trackers for functionality, performance, or advertising-related purposes where consent is required.

Your consent to the placement of the Cookie and the related use of your Personal Information, where required by law (including EU ePrivacy rules).

In countries permitting this without consent, we may rely on our legitimate interests in understanding and improving how users engage with our Sites, products, or communications, provided these interests are not overriden by your privacy rights under applicable law.

Qualifications & exceptions

• Consent applies where required by law, including EU ePrivacy rules.
• Legitimate interests are available only in countries that permit the activity without consent, and only if not overridden by your privacy rights under applicable law.
• Email Trackers are included only where consent is required.

Not stated here

• Which countries permit the activity without consent is not listed.

Cross-references

• qualified by (model-proposed): Mastercard processes cookie data only where it has a legal basis — The general rule that Personal Information from Cookies and Email Trackers is processed only where law permits and a legal basis exists is applied by the table rows that follow.

Legal Rights & Agreement Rules · Procedure

Your privacy rights and how to use them are in another notice

To learn more about your choices or to exercise your privacy rights, Mastercard refers you to its Global Privacy Notice, or a Site's own privacy notice if it has one. This Notice does not itself describe the rights or how to exercise them.

Supporting quotations

To learn more about your choices or to exercise your privacy rights, please consult our Global Privacy Notice (or if a Site has its own privacy notice, that notice).

Qualifications & exceptions

• A Site's own privacy notice replaces the Global Privacy Notice where one exists.

Not stated here

• The rights and how to exercise them are not described in this Notice; the Global Privacy Notice is linked but not supplied.

Legal Rights & Agreement Rules · Procedure

Data transfers are covered in Section 5 of the Global Privacy Notice

On data transfers, the Notice only refers you to Section 5, Data Transfers, in the Global Privacy Notice, or the corresponding section of a Site's own privacy notice. It states no transfer practices itself.

Supporting quotations

See Section 5 Data Transfers in our Global Privacy Notice (or if a Site has its own privacy notice, the corresponding section in that notice).

Qualifications & exceptions

• A Site's own privacy notice's corresponding section replaces it where the Site has its own notice.

Not stated here

• Where Personal Information is transferred, and on what safeguards, is not stated in this Notice. The cited Section 5 is in the Global Privacy Notice, which is not supplied.